Previous to El Capitan one could use pfctl and /etc/pf.conf to "trap" the ip addresses of sites attempting to break into a server using brute force attacks producing 100's of attempts per second. The rules one created would put the offending ip addresses into an "attackers" table and then reject any connection attempts from that ip address.

With El Capitan, all port connections appear to be handled first by launchd and now the pfctl method has no effect.

Does anyone know how to adapt the pfctl approach to this new connection logic? The automatic detection rules were really effective.


I don't believe pfctl was enabled by default in either Yosemite or El Capitan. You can still edit the /etc/pf.conf file, add rules, tables, etc., and then load and enable pfctl and you'll be up and running:

sudo pfctl -f /etc/pf.conf -e

See http://128bitstudios.com/2010/06/13/stopping-ssh-brute-force-attacks-with-pf-on-freebsd for a really simple but effective way to get an SSH rule to prevent bruteforce attacks.

Also see http://krypted.com/mac-security/a-cheat-sheet-for-using-pf-in-os-x-lion-and-up

If you want pfctl to load at boot you'll need to roll your own launchd script.

Another option is a GUI app like Murus. You can then examine the launchd file it creates and the PF files in /etc/murus and understand better how to make this work for you.

  • many instructions will tell you to run sudo pfctl -f /etc/pf.conf but that was not enough to get it workin on my machine (10.13). You need the -e to actually enable the packet filter.= as Dan said. Should really be scored as an answer. – lbutlr Aug 13 '17 at 19:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .